Offline code based reloading system

ABSTRACT

An offline code-based reload device and method for adding value to a reconfigurable memory storage means in a portable storage medium. Reload is effected using a reload device not directly connected by telephone or any other communication network to a value supplier. The system uses a “one time use number” (“OTN”) generated by a computer program containing an algorithm containing information on the value to be added and a transaction sequence number (“TSN”). Upon presentation of the portable storage medium to the reload device and entry of the OTN into a numeric keypad, the reload device decodes or disassembles the OTN to verify its authenticity, validate that it was created for the specific portable storage medium presented to the reload device and to verify through the TSN that the OTN has not been previously used to add value from the receiving reload device or any other reload device. The reload device further extracts the value from the OTN, adds the value to a selected purse on the portable storage medium and loads a new TSN to the portable storage medium.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a division of U.S. patent application Ser. No.10/462,520 filed Jun. 16, 2003, which is incorporated herein byreference in its entirety.

FIELD OF THE INVENTION

This invention relates generally to a low cost means of adding value toportable media such as “smart cards” of microprocessor or encryptedmemory types, key fobs, magnetic stripe cards or any other form factorthat permits electronic read/write functions that can be used to replacecoins in exact change payments of small amounts spent by a consumer.

BACKGROUND OF THE INVENTION

Traditionally, exact change micropayment transactions such as vendingmachines, pay-for-use laundry machines, pay telephones and publictransit access were facilitated through the use of coins. A user wouldobtain a sufficient number of coins or tokens of the correctdenomination to obtain the desired product or service. Bill changerswere sometimes provided but are expensive to install and maintain, andare prone to burglary with the result that coins are not generallyavailable to the public at the place where the exact change micropaymenttransaction is to take place.

In recent years alternatives to coins for micropayments have beendeveloped to reduce the nuisance of carrying or searching for exactchange. These alternative payment forms have typically been such mediaas disposable smart cards or magnetic swipe cards. These media typicallyhave a preloaded value when purchased from a vendor. There are majordisadvantages with these micropayment media. The first disadvantage withthese micropayment reload devices is to the user. With prepaid/preloadedcards, the user must purchase cards in fixed cash increments creatingthe problem of having residual non-useable value left on the media,depending on the vend rate for the desired product or service. The mediais disposable which adds cost to the issuer. There are also additionalcosts associated with distribution, most notably, payments to retailvendors for distributing such media and security issues with cards thathave preloaded value.

Reloadable microchip media such as smart cards and key fobs, andencrypted magnetic media such as swipe cards have the potential ofovercoming all of these problems with a number of additional benefitsincluding the ability to load non-preset or fixed amounts, facilitatinga low cost means of granting repayments of error amounts or lost amountsthereby saving the costs of mailing small refund cheques and placingadditional applications such as loyalty programs on the media.

Historically the replacement of coins by reloadable smart cards andother electronic micropayment media has been prohibitively expensive dueto the high cost of reload devices such as currency acceptors to mediaand credit/debit card acceptors to media. The high cost of such reloaddevices has limited their availability resulting in a lack ofinfrastructure to support the widespread adoption of reloadablemicropayment media.

Currency acceptors are high cost, armoured, mechanical reload devicesprone to breakage and counterfeit money and carry substantial risks ofburglary and vandalism. They must be placed in high security locationsand the funds accumulated in the boxes need to be collected, counted andpresented to banks in a secure environment at considerable cost.

Debit/credit card reload devices while lower in cost than currencyacceptors initially carry the ongoing costs of networking to telephoneor other remote communications systems in order to validate thefinancial transactions. In addition, these are not usable by people whohave neither credit nor debit account facilities or balances withfinancial institutions.

Realizing these disadvantages in the deployment of reloadablemicropayment reload devices the present invention provides such loadingservices in a completely offline environment thus reducing the capitalnecessary to deploy reload devices in adequate numbers to conveniencethe user. In addition to the added convenience the user will also havethe ability to load non-fixed amounts if so desired. Such a reloaddevice has the added benefit of enabling the issuing organization togrant refunds to their media using customers, saving the additionalcosts of mailing refund cheques to users who have substantiated refundclaims further adding convenience to customers.

SUMMARY OF THE INVENTION

A method for a value supplier to transfer value to an electronic pursepossessed by a holder without requiring direct electronic communicationbetween said value supplier and said medium, said method comprising thesteps of:

-   -   (i) providing a portable storage medium to said holder having a        Card Identification Code (“CIC”), a machine readable and        reconfigurable Transaction Sequence Number (“TSN”) storage area        and at least one said purse wherein each said purse is a machine        readable and reconfigurable storage means and has a unique purse        address;    -   (ii) recording said TSN against said CIC in a reconfigurable        data storage and retrieval system;    -   (iii) receiving a request from said holder including said CIC, a        desired value and payment instructions;    -   (iv) determining said TSN stored in said data storage and        retrieval system against the CIC presented in step (iii);    -   (v) using an encryption algorithm to generate a unique One Time        Number (“OTN”) based on said CIC, said TSN, said purse address        and said desired value;    -   (vi) presenting said OTN to said user;    -   (vii) reconfiguring said TSN in said storage and retrieval        system to vary said TSN by a predetermined increment;    -   (viii) providing a reload device having a reader for reading        said TSN and CIC from said portable storage medium, CIC input        means for receiving said CIC on said storage medium, OTN input        means for receiving said OTN from said holder, a decrypter        having a decryption algorithm corresponding to said encryption        algorithm in step (v) for decrypting said OTN, a verifier for        verifying that said CIC and TSN on said storage medium match        said OTN input by said holder and a loader for loading value        into said purse corresponding to said desired value;    -   (ix) receiving said storage medium in said reloader;    -   (x) determining said CIC and said TSN on said storage medium and        receiving said desired value and said OTN;    -   (xi) decrypting said OTN using said decryption algorithm;    -   (xii) verifying whether said CIC and TSN components of said OTN        conform to said CIC and said TSN on said storage medium;    -   (xiii) if said verifying in step (xii) determines conformance,        loading said desired value into the purse identified by said        purse address and incrementally adjusting said TSN on said        storage medium by said predetermined increment in step (vii);        and,    -   (xiv) if said verification in step (xii) fails to determine        conformance, causing said reloader to display an error message.

The method may include the further steps of:

-   -   (xv) configuring said reload device to monitor a predetermined        number of retries of steps (ix) through (xii) for a given of        said storage medium and, should said predetermined number of        retries fail to yield a determination of said conformance, to        enter a “disabled” indicator on said storage medium; and,    -   (xvi) further configuring said reload device to check for said        disabled indicator and if detected, cease carrying on with the        transaction steps and to display an error message to said        holder.

The payment instructions received in step (iii) may include paymentissuer information and may be confirmed with the issuer prior tocontinuing. Should payment be refused by the payment issuer thecardholder may be notified accordingly.

A reload device is provided for a portable value storage medium(“medium”). The reload device has a medium reader for reading a storedtransaction sequence number (“TSN”) stored on the medium, a CIC inputmeans for receiving a presented Card Identifier Code (“CIC”) and an OTNinput means for receiving an One Time Number (“OTN”) containingencrypted TSN, CIC and value components and purse address. The reloaddevice further has a decoder for decoding the OTN to determine theencrypted TSN, CIC and value components. The reload device also has acomparator communicating with the medium reader, CIC input means, OTNinput means and decoder for comparing at least the encrypted TSN and CICwith the stored TSN and presented CIC. A loader communicates with thecomparator for loading value onto the medium corresponding to the value.The comparator is configured to only load the value if the encrypted TSNand CIC components accord with the stored TSN and presented CIC. Thereload device also has a TSN updater for updating the stored TSN to anext sequential TSN.

The reload device may have a security means associated with the reloaderand the comparator. The security means may disable the medium upondetecting a predetermined number of unsuccessful OTN inputs against aparticular CIC, causing an error message to be presented to a holder ofthe medium seeking to add value thereto.

A security means may, after the unsuccessful OTN inputs place arestriction on the card against further use. The medium reader may readany such restriction and notify the comparator to disable the storagemedium without requiring any further unsuccessful attempts.

An OTN generator is provided for generating a One Time Number (“OTN”)for subsequent offline use with any of the issuing organization'sloaders for loading a predetermined value onto a storage medium having aCard Identifier Code (“CIC”) and a reconfigurable stored TransactionSequence Number (“TSN”). The OTN generator has a database for storageand retrieval of information on account status, CIC's for issued cardsand the current TSN associated with each CIC. The OTN generator furtherhas a system processor communicating with the database and access meansassociated with the processor for oral or written communication betweena holder of the medium and the OTN generator. The OTN generator furtherhas input means associated with the access means for receiving the CIC,a desired amount and type of value to be processed and a purse address.Debit means may be associated with a system processor for debiting thesource of funds by an amount corresponding to the desired amount ofvalue. Verification means may be associated with a system processor fordetermining whether the source of funds identified by the holder of themedium is in good standing. An encrypter may be associated with thesystem processor for generating the OTN according to an encryptionalgorithm based on at least the CIC, the TSN, the desired value andpurse address. The processor may be configured to provide an errormessage if the account is not in good standing. The processor may beconfigured to signal the encrypter to generate a valid OTN and tocommunicate the valid OTN to the holder. The holder is thus able toinput the OTN into the reloader for decryption and for the reloader towrite a value onto the medium. The processor may further be configuredto update the database to adjust the TSN associated with the CIC by apredetermined increment after generating a valid OTN.

The access means of the OTN generator may communicate over at least oneof a computer and a telephone network. The input means of the OTNgenerator may be a telephone handset or a computer keyboard. The OTNgenerator output may be electronic via speech generator or written to adisplay screen or a document generator.

DESCRIPTION OF DRAWINGS

Preferred embodiments of the present invention are described below withreference to the accompanying illustrations in which:

FIG. 1 is a pictorial representation of a storage medium according tothe present invention;

FIG. 2 is a perspective view illustrating a reload device according tothe present invention;

FIG. 3 is a device functional block diagram of the reload device;

FIG. 4 is a device level transaction flow chart for the reload device;

FIGS. 5 and 6 are a flow chart in two parts illustrating a device leveltransaction flow algorithm in accordance with the present invention;

FIG. 7 is a flow chart illustrating a manner according to the presentinvention that an OTN may be provided to a holder;

FIG. 8 is a flow chart illustrating an alternative embodiment of a waythat an OTN may be provided to a holder;

FIG. 9 is a block diagram illustrating OTN encryption elements;

FIG. 10 is a schematic illustration of an OTN generator in accordancewith the present invention; and,

FIG. 11 is a flow chart illustrating a possible sequence of steps forresychronizing a TSN according to the present invention.

DESCRIPTION OF PREFERRED EMBODIMENTS

A storage medium according to the present invention is generallyindicated by reference 20 in FIG. 1. The storage medium 20 may be amagnetic stripe card although other configurations, such as a microchipcontained in a card, a key fob or other physical carrier may beutilized.

The storage medium 20 has a card identification code 22 (“CIC 22”)unique to that storage medium 20.

The CIC 22 would generally be user readable as the users would berequired to recite it as part of the transaction described below.

The storage medium 20 has an area 24 which is machine readable andreconfigurable on which is stored a Transaction Sequence Number (“TSN”).The storage medium further has at least one area referred to as a“purse” 26 which is a reconfigurable storage means to which value may beadded and from which value may be removed. The purse 26 may be part ofthe area 24 or an adjunct thereto. Each purse 26 would have a uniqueaddress associated with it. The address would have to be accessed toload each purse 26.

In use, the storage medium 20 may be issued to a holder (reference 208in FIG. 10) by a value supplier. The holder 208 can then contact thevalue supplier and, as discussed in more detail below, arrange to havevalue added to the purse 26. The value is added using a reload device 50in FIG. 2. The reload device and the value supplier in effectcommunicate via an encrypted code (i.e. the One Time Number (“OTN”))using the holder 208 as an intermediary rather than through directelectronic communication.

The storage medium 20, once loaded, may be utilized to transfer at leasta portion of the value to a storage medium reader such as a vendingmachine, a washing or drying machine, a telephone, a transit system orother users where preferably cashless small transactions are required.As different users may have different purse requirements, more than onepurse 26, each satisfying different user requirements, may be provided.For example a transit pass may be configured in terms of “passes” withone pass required per ride rather than having a monetary value which isdebited by a medium reader. The expression “value” should therefore bebroadly interpreted to include other than actual cash values loaded.

FIG. 2 is a pictorial representation illustrating a reload device 50according to the present invention. FIG. 3 is a device functional blockdiagram of the reload device 50.

The reload device 50 includes a medium reader 52 for reading informationstored on the storage medium 20, in particular the TSN on the area 24and preferably also the purse 26.

The reload device 50 further has a CIC input means such as the keypad 54for receiving the CIC 22. While a keypad 54 is illustrated, alternativemeans may be utilized. For example the CIC may be both printed on thecard and stored on the card in machine readable form in which case themedium reader 52 may also be configured to act as the CIC input means.

The reload device 50 has an OTN input means for receiving the OTN. TheOTN input means may be the keypad 54. The OTN is an encrypted code basedon the TSN, the CIC and value components. The OTN may also contain apurse identifier component such as a purse address. The OTN is in effectthe message carried by the holder of the storage medium from the valuesupplier to the reload device 50 which enables verification of thestorage medium 20 and loading of value into the purse 26.

As the OTN is an encrypted message to the reload device 50, the reloaddevice 50 includes a decoder 55 which may be a reload processor 56communicating with a first security module 58 which runs a decryptionalgorithm. The decoder 55 receives the OTN and determines the TSN, CICand value components.

The reload device 50 also has a comparator for comparing the CIC and TSNinput or read from the storage means 20 with the TSN and CIC determinedby the decoder 55. This may for example be accomplished by suitablyconfiguring the reload processor 56 and having it communicate with thekeypad 54, medium reader 52 and first security module 58. “Suitablyconfiguring” refers to providing appropriate hardware and softwareeither as part of or in communication with the reload processor 56.

The comparator determines whether the information contained in the OTNaccords with the TSN and CIC on the storage medium 20. If it does, thenthe comparator instructs, such as through the reload processor 56, aloader 60 to add the value to the appropriate purse 26. If it doesn'tthen the comparator may simply refuse to instruct the loader 60 but morepreferably will arrange for an error message to be presented to theholder of the storage means 20. This may be accomplished bycommunicating the non-accord condition to the reload processor 56 whichin turn instructs a display 64 also in communication therewith todisplay the error message.

The reload device 50 is also provided with a TSN updater for updatingthe TSN after each successful transaction. This may form part of theloader 60. The TSN is updated for example by a predetermined incrementor to a next predetermined sequential value after each successfultransaction. This prevents the storage medium 20 from being loaded againusing the same OTN. The reason it can't be loaded again is that theupdated TSN will not accord with the encrypted TSN resulting in anon-accord determination by the comparator.

The reload device 50 may incorporate further security features forexample a second security module 62 may communicate with the reloadprocessor 56 to provide access codes enabling the reload processor 56 tocommunicate with the medium reader 52, keypad 54 and possibly also thefirst security module 58.

Additionally, the reload 50 processor 56 may be configured to monitorsubsequent unsuccessful attempts to load value such as may be the caseif someone is attempting to guess an OTN. The area 24 or any other areaof the storage medium 20 which is machine readable may then be loadedwith a “security lock-out” notation which can be detected by the mediumreader 52 and communicated to the reload processor 56. The reloadprocessor may be further configured to disable the storage medium 20 andcause the display 64 to present a suitable error message. Therestriction on reloading may be time limited.

Alternatively, once a security lock-out notation is placed on thestorage medium 20, the system can be configured to require entry of aone time “release” code to be provided by the value supplier in order toremove the security lock.

On occasion it may be necessary to resynchronize the TSN on the storagemedium 20. This might for example occur as a result of a systemmalfunction. Accordingly the reload processor 56, decoder 55 and loader60 may be configured to allow the keypad to present a coded TSN to thereload processor 56 for decoding by the decoder 55 and loading onto thestorage medium 20 in lieu of any previously loaded TSN.

FIG. 4 is a device level transaction flowchart 100 for the reload device50 illustrating user interaction with the device. Box 102 corresponds tothe user inserting the storage medium 20 into the medium reader 52 andthe medium reader 52 reading the storage medium 20. Box 104 depicts thedisplay 64 showing the balance on the card. Alternatively the display 64could prompt for the OTN and also the CIC if the CIC isn't read by themedium reader 52. Box 106 represents the user entering the OTN on thekeypad 54.

The reload device 50 next performs a validation algorithm at box 108which is performed by the comparator. Should the validation result infailure as depicted by box 110, an error message is displayed asdepicted by box 112. Should the validation prove successful, the display64 may be instructed to display an approved load value as depicted bybox 114.

The reload processor 56 may also be configured to determine whether theapproved reload amount will exceed a predetermined maximum balance inthe selected purse 26. This is depicted by box 116. Should this occur,the display 64 may be caused to present such a message as depicted bybox 110 and further prompt the holder to remove the storage medium 20from the reload device 50, as depicted by box 112.

Should the selected purse 26 be capable of accepting the approved loadvalue the reload processor 56 may instruct the display 64 to display thecurrent balance (box 120) and instruct the loader 60 to load theapproved value into the selected purse 26 as depicted by box 122. Thereload processor 56 may then calculate and cause the display 64 topresent first the new balance (box 124) and finally cause the display 64to display a message, such as at box 126, informing the holder that thetransaction is complete and prompting the holder to remove the storagemeans 20 from the reload device 50.

FIGS. 5 and 6 are a flow chart in two parts illustrating a device leveltransaction flow algorithm 150 in accordance with the present invention.

At reference 152 the storage medium 20 is presented to the medium reader52. At reference 154 the display 64 shows any remaining balance on thecard. The reload device next, at reference 156, determines if anysecurity lock-out is active on the card. If a security lock-out isactive, then, at reference 158 the reload device 50, typically throughits reload processor 56 determines if the security lock-out has expired.If it has expired, then at reference 160, it is erased, If it hasn'texpired, then at reference 162 the display 64 is operated to present anappropriate message. This assumes that a time sensitive securitylock-out is being used, which may not be the case. The system may beconfigured to require that a one time code be obtained from the valuesupplier in order to remove the security lock-out.

If a security lock-out is either not present or has expired the reloaddevice 50 accepts a user entered OTN at reference 164. The reloadprocessor 56 extracts the TSN from the OTN at reference 166. Thecomparator at 168 compares the decrypted TSN with the TSN read off ofthe storage medium 20 by the medium reader 52. A failed match causes thedisplay 64 to present an appropriate message at reference 170. Next atreference 172, the reload processor 56 determines whether apredetermined sequential retry threshold has been achieved. If not thestorage medium may be reinserted at 152. If it has been achieved then asecurity lock-out, which may be time sensitive, is placed on the storagemedium 20 at reference 174, at least temporarily disabling the storagemedium 20 from operating the reload device 50.

It will be appreciated that presence of a security lock-out disables thestorage means 20 from being used with any reload device 50. This isbecause the security lock-out is carried by the storage means 20 ratherthan by the reload device 50.

If no security lock-out is currently active and the decrypted TSNmatches the stored TSN, full decryption begins at referenced 176. Atreference 178 the comparator checks for a match between the CIC on thestorage medium 20 and the CIC decrypted from the OTN. A failed matchcauses a return to step 170. A successful match at reference 180 mayresult in the reload processor 56 determining which purse 26 to load ifmore than one purse 26 is available. This can be part of the informationencrypted in the OTN. Next, at reference 184, the reload processor 56determines whether adding the approved value will exceed a maximumbalance. If yes, then the display is operated to present a suitablemessage at reference 186 which may also prompt the holder to remove thestorage medium 20 from the reload device 56.

Should the approved load value not exceed the maximum card balance, thevalue is added and the TSN sequentially adjusted. Either may follow theother. According to the FIG. 6 embodiment the TSN is incremented atreference 188 and the value loaded to the purse 26 by the loader 60 atreference 190. Appropriate accompanying messages may also be displayed.For example at reference 192 the current balance and amount being loadedmay be displayed. Next at reference 194 the new balance may bedisplayed. Generally at reference 196 the holder is instructed to removethe card and the reload transaction is completed at reference 198.

FIGS. 7 and 8 are flow charts illustrative of two ways that an OTN maybe provided to the holder. FIG. 9 illustrates the OTN encryptionelements. FIG. 10 is a schematic illustration of an OTN generator 200 inaccordance with the present invention.

The OTN generator 200 has a database means 202 for storage and retrievalof information on account status associated with each storage medium 20that has been issued and may include information on account status ofthe holder 208 as well as any other relevant account. The database 202may further provide for storage and retrieval of CIC's for issuedstorage medium 20 and current TSN's associated with each CIC.

The OTN generator 200 has a system processor 204 which communicates withthe database 202. Access means 206 are associated with the systemprocessor to enable communication between a holder 208 of the storagemedium 20 and the system processor 204. The access means 206 has inputmeans 210 which may be fully automated for example relying on a computerhook-up over the Internet or utilizing touch tone features of atelephone handset. Alternatively (or additionally) the access means 206may have input means 210 which uses human intervention such as a callcentre wherein the call recipient has keyboard access to the systemprocessor.

The input means 210 may prompt for and receive the CIC and a desiredamount of value from the holder 208. As well the input means 210 mayprompt for and receive a source of funds 212 selected by the holder 208from where the value is to be obtained. The source of funds may forexample be a credit facility or a bank account held by the holder 208.The credit facility may be a credit card company or the value supplierthat controls the OTN generator 200.

Account verification means 214 may be associated with system processor204 for determining whether the selected source of funds is in goodstanding. The account verification means may in turn communicate withthe source of funds 212 or with the database 202 depending on whethercurrent or historical data is to be verified.

Debit means 216 are associated with the system processor 204 forenabling the system processor 204 to debit the source of funds 212 by anamount corresponding to the desired value and possibly also a service ortransaction charge.

An encrypter 218 is associated with the system processor 204 forgenerating the OTN according to an encryption algorithm. As discussedabove, the encryption algorithm would typically be based on at the CIC,TSN and the desired amount of value. The encryption algorithm may alsotake into account which purse 26 is selected if more than one isavailable.

The system processor 204 may be configured to signal the encrypter togenerate an OTN which will cause the reload device 50 to generate anerror message if the account is not in good standing. Alternately theOTN may communicate an appropriate message to the holder 208 through theaccess means 206 should this be the case.

The system processor 204 may be further configured to signal theencrypter to generate a valid OTN and to communicate the OTN to theholder through the access means 206. Output means 220 may be provided incommunication with the system processor 204 to link the system processor204 with the access means 206. The input means 210 and output means 220may be incorporated in a common element of the OTN generator 200.

The system processor 204 is further configured to update the database toadjust the TSN associated with the CIC of the storage medium 20 to beloaded by a predetermined increment. The predetermined increment will bethe same for the OTN generator 200 as for the reload device 50.

FIG. 7 illustrates how an OTN may be generated with the OTN generator200 in an automated telephone system configuration. At reference 300 theholder 208 calls an automated telephone number. The holder 208 may beprompted to and may choose a language preference at reference 302. Atreference 304 the holder 208 is prompted for and enters, using atelephone keypad, the CIC number. The holder 208 is then prompted forand enters a credit card number and expiry date at reference 306. Atreference 308 the holder 208 is prompted for and enters a desired loadamount, and, if applicable, a selected purse 26.

The system processor 204 verifies the availability of funds at reference310 through the account verification means 214. Should the verificationfail, as indicated at reference 312, the transaction is cancelled asindicated by reference 314.

Should the verification be successfully approved, the system processor204, using the encrypter 218, generates an OTN at reference 316. Thesystem processor further increments the TSN in the database 202 at 318and provides the OTN to the holder at reference 320.

It will be appreciated that the above sequence may be varied to someextent. For example the load amount and purse may be entered before thecredit card information. Also the TSN may be incremented after the OTNis provided to the card holder 208.

FIG. 8 is a flow chart illustrating the generation of an OTN using acall centre as the access means 206. The holder 208 phones the callcentre at reference 350 and provides, possibly upon prompting, the CICat reference 352. The holder 208 is further prompted for and provides acredit card number and expiry date at reference 354 and a desired loadamount and purse 26 at reference 356. The holder 208 would supply theforegoing information to a call centre operator who has input means 210for inputting the information into the system processor 204.

The system processor 204 may verify the transaction with the source offunds 212 at reference 358. Although it is expected that in most casesthe system processor 204 would be a computer, it may be possible to usea human operator as the system processor 204 as long as access isprovided to the peripheral components of the OTN generator 200 whichcommunicate with the system processor 204.

Should verification result in a denial, as shown at reference 360, thetransaction is cancelled at reference 362 and the holder 208 may beinformed accordingly.

Should verification prove successful and result in acceptance, the callcentre at reference 364 enters the data into the system processor whichat reference 366 runs the encrypter 218 to calculate the OTN. This mayfurther require accessing the database 202 to obtain the current TSN.The call centre provides the OTN to the holder 208 at reference 370, theTSN is incremented in the database 202 at reference 368 and thetransaction is complete.

FIG. 9 is a schematic diagram illustrating one manner in which an OTNmay be encrypted. Two encryptions are illustrated. In a first encryption400, elements of the CIC, approved load amount and desired purse areloaded at references 402, 404 and 406 respectively. The first encryptionyields a first result 408. A second encryption occurs at reference 410and is based on the TSN which is loaded at 412. The second encryptionencrypts the TSN to yield encrypted TSN 414. The encrypted TSN 414 iscombined with the first result 408 to yield a resultant OTN 416 which isthe OTN provided to the holder 208.

FIG. 11 is a flow chart illustrating a possible sequence of steps forresychronizing a TSN when a load attempt fails. At reference 500, theholder 208 calls a call centre to report a failed attempt. The callcentre obtains the CIC and at reference 502 determines the TSN. The TSNmay be encrypted at reference 504 for example using the encrypter 218and the encrypted TSN is provided to the holder 208 at reference 506.The user records the encrypted TSN at reference 508 and the call centremay, at reference 510 synchronize the database with the new TSN.

Reload devices 50 of the above type may be owned by different issuingorganizations, each of which will have their own OTN generator 200.Should this be the case, provision will be required to separate oneorganization's storage media 20 and reload devices 50 from those ofanother. This may be accomplished for example by having an organizationidentifier as part of the purse address.

The above description is intended in an illustrative rather than arestrictive sense. Variations may be apparent to those skilled in theart without departing from the spirit and scope of the invention asdefined by the claims set out below. For example it may not be necessaryto follow the exact sequence of steps described or to use the exactencryption methodology. Variations to these and other aspects will nodoubt be apparent to those skilled in the relevant arts.

1. A method for a value supplier to transfer value to an electronicpurse possessed by a holder without requiring direct electroniccommunication between said value supplier and said medium, said methodcomprising the steps of: (i) providing a storage medium to said holderhaving a Card Identification Code (“CIC”), a machine readable andreconfigurable Transaction Sequence Number (“TSN”) storage area and atleast one said purse wherein each said purse is a machine readablereconfigurable storage means and has a unique purse address foridentifying each said purse; (ii) recording said TSN against said CIC ina reconfigurable data storage and retrieval system; (iii) receiving arequest from said holder including said CIC, a purse address, a desiredvalue and payment instructions; (iv) determining said TSN stored in saiddata storage and retrieval system against the CIC presented in step(iii); (v) using an encryption algorithm to generate a unique One TimeNumber (“OTN”) based on said CIC, said TSN, said purse address and saiddesired value; (vi) presenting said OTN to said user; (vii)reconfiguring said TSN in said storage and retrieval system to vary saidTSN by a predetermined increment; (viii) providing a reload devicehaving a reader for reading said TSN from said portable storage medium,CIC input means for receiving said CIC from said storage medium, OTNinput means for receiving said OTN from said holder, a decrypter havinga decryption algorithm corresponding to said encryption algorithm instep (v) for decrypting said OTN, a verifier for verifying that said CICand TSN on said storage medium match said OTN input by said holder and aloader for loading value into said at least one purse corresponding tosaid desired value; (ix) receiving said storage medium in said reloader;(x) determining said CIC and TSN on said storage medium, said desiredvalue, said purse address and said OTN; (xi) decrypting said OTN usingsaid decryption algorithm; (xii) verifying whether said CIC and TSNcomponents of said OTN conform to said TSN and said CIC on said storagemedium; (xiii) if said verifying in step (xii) determines conformance,loading said desired value into the purse identified by said purseaddress and incrementally adjusting said TSN on said storage medium bysaid predetermined increment in step (vii); and, (xiv) if saidverification in step (xii) fails to determine conformance, causing saidreloader to display an error message.
 2. The method of claim 1 includingthe further steps of: (xv) configuring said reload device to monitor apredetermined number of retries of steps (ix) through (xii) for a givenof said storage medium and, should said retries all fail to yield adetermination of said conformance to enter a “disabled” indicator onsaid storage medium; and, (xvi) further configuring said reload deviceto check for a said disabled indicator and if detected, to refuse toload said purse and to display an error message to said holder uponreceiving said storage medium.
 3. The method of claim 2 wherein: saidpayment instructions received in step (iii) include payment issuerinformation; said payment instructions are confirmed with said issuerprior to continuing; should payment be refused by said payment issuereither refusing to continue and notifying said holder.
 4. The method ofclaim 3 wherein said loader loads said value onto said purse accordingto said payment instructions in all cash increments requested by saidholder that are confirmed by said payment issuer.